Correction: the vendor had publicly described a catalogued flaw that the record said was described nowhere but the catalog
Every record in this file was ratified by the publisher on 2026-11-12 and is in force. The declared field gives the date the correction was first recorded.
- id
- CHQ-CORR-2026-028
- class
- CORRECTION
- subtype
- editorial
- status
- IN FORCE
- authority
- DM ratified 2026-11-12
- effective
- 2026-11-12
- published
- 2026-11-12
- title
- Correction: the vendor had publicly described a catalogued flaw that the record said was described nowhere but the catalog
- what was wrong
- The record from 31 October 2026, and draft text of both editions of Issue No. 45, said the catalog sentence was the only public description of CVE-2026-118527. That was false at every check, because CHQ had checked the CVE program and the agency's enrichment source and not the vendor.
- what is true
- The vendor's advisory added the identifier on 29 October with a description, a severity vector and fixed versions. Two further descriptions were published on 2 November. What is absent is the CVE program record and the agency's enrichment record, so the agency's own decision values behind its deadline are not public.
- what changed
- The issue's finding is narrowed to the CVE record and the agency's scoring. The vendor advisory is retained and cited. CHQ does not infer the agency's computation from the vendor's vector.
- what did not change
- No count, rating, Outlook or Watch.
- control analysis
- A claim that no public record exists now requires the vendor advisory to have been checked. That is a rule in the run protocol, not a mechanical control.
- found by
- An external review that cited two national CERT bulletins, verified by CHQ against the primaries.